RigAI Tech Pvt. Ltd.

RigAI Tech Pvt. Ltd. ("RigAI", "we", "our" or "us") is committed to protecting personal information processed through our websites, software platforms, applications, integrations and related services.

This Privacy Policy explains how we collect, access, use, store, disclose, retain and protect personal information in connection with our websites and services, including SynSok, SynSok GX, VoiceStack, SOS, our property management system (PMS) integrations, restaurant and hotel operations software, and other products or services we introduce from time to time (collectively, the "Services").

RigAI primarily provides software and technology services to businesses, including hotels, resorts, hotel groups, restaurants, travel companies and other enterprises. Depending on the Services enabled by a customer, we may process information about business customers, employees, authorised users, hotel guests, restaurant customers, suppliers and other individuals on behalf of our customers.

This Policy applies to personal information processed by RigAI in its capacity as a service provider, data processor, or independent data controller, as applicable to the particular activity.

1. Information We Collect and Process

The information we process depends on the Services used, the integrations enabled, the permissions granted and the configuration selected by the relevant customer.

1.1 Business and Account Information

We may process:

Names, job titles, business email addresses and telephone numbers.
Business names, addresses and organisation details.
Account identifiers, authentication information and user roles.
Billing, invoicing and tax information.
Customer onboarding details, service configurations and preferences.
Records of communications with our sales, support and account management teams.

1.2 Authentication and Connected Account Access

RigAI may process account identifiers, authentication records, authorisation status, permission information and access tokens or other credentials issued through supported authentication and integration mechanisms, where necessary to connect and operate customer-authorised services.

Where a third-party platform provides an authorisation mechanism, such as Meta OAuth or an equivalent business-account connection flow, access is obtained through that mechanism and is limited to the permissions granted and functionality enabled.

RigAI does not ask users to provide their Facebook, Instagram, WhatsApp or other third-party account passwords directly to RigAI. Integration credentials and access tokens, where used, are treated as confidential information and protected through appropriate access controls and security measures.

1.3 Technical, Device and Usage Information

When users access our websites, applications or Services, we may process:

IP addresses, browser types and device information.
Operating systems, application versions and connection information.
Login records, authentication events and access logs.
Usage events, diagnostic information and error reports.
Security alerts, audit trails and operational monitoring information.

We use this information to operate our Services, troubleshoot issues, maintain security and improve reliability.

1.4 Hotel, Reservation and Guest Information

Where a customer enables relevant functionality or integrations, we may process:

Guest names, contact details and reservation identifiers.
Room numbers, stay dates, arrival and departure information.
Reservation status, room assignments and service preferences.
Guest requests, feedback, service histories and loyalty-related information.
Restaurant orders, food and beverage preferences and service transactions.
Housekeeping requests, maintenance requests and other hotel operational records.
Guest communications, transcripts, summaries and related service records.

The exact information depends on the customer's systems, configuration and authorised purposes. Customers are responsible for ensuring that they have the appropriate rights, notices and legal grounds to provide this information to RigAI.

1.5 Meta, Facebook, Instagram and WhatsApp Information

Where a customer or authorised business connects a supported Meta service to our platform, we may process information made available through the relevant Meta APIs, permissions and business integrations.

Depending on the integration and permissions enabled, this may include:

Facebook Page identifiers and business account information.
Instagram professional account identifiers, usernames and permitted profile information.
WhatsApp Business Account identifiers, business phone number identifiers and permitted business profile information.
Messages and message content received through supported messaging integrations.
Message timestamps, delivery receipts, read receipts, status notifications and webhook event information.
Relevant conversation identifiers, routing information and customer service records.
Authorisation and connection metadata required to maintain the integration.
Access permissions and integration configuration information.

We process this information to provide authorised messaging, guest communication, customer service, automation, operational workflows, reporting and related features requested by the customer.

The actual information accessible to RigAI depends on the applicable Meta product, the permissions granted, the customer's account configuration and the relevant platform policies.

RigAI does not claim access to information that the applicable APIs and permissions do not make available. We do not request users' Facebook, Instagram or WhatsApp account passwords.

1.6 Property Management Systems and Hotel Integrations

Where a customer authorises a connection to a property management system, central reservation system or another hospitality platform, we may process the information required to provide the requested integration.

Supported or potentially supported integrations may include Oracle Hospitality OPERA Cloud, other Oracle Hospitality products where an appropriate integration is available, Cloudbeds, Mews, and other PMS or hospitality systems.

Depending on the integration and permissions granted, information may include:

Reservation, arrival, departure and room information.
Guest profiles and contact information.
Room status, housekeeping and maintenance information.
Guest requests, service messages and operational updates.
Authorised master data, transaction information and relevant reporting data.
Integration identifiers, event notifications, configuration and diagnostic records.

We access and process only the information made available through the relevant integration and authorised for the customer's use of the Services.

The availability of an integration does not mean that it is currently enabled, certified, or connected for every customer or property. Integrations are subject to the relevant provider's technical requirements, contractual terms, permissions and availability.

1.7 Customer-Provided Content

Customers may provide menus, food and beverage descriptions, images, logos, brochures, brand assets, operating procedures, policies, service catalogues, training materials and other business content.

We process such content to configure, operate and deliver the relevant Services, including digital menus, ordering, guest communication, AI-assisted workflows, operational management and reporting.

1.8 Voice and Conversation Information

Where voice-enabled features are enabled, we may process voice communications, audio recordings where recording is configured, speech-to-text transcripts, text conversations, AI-generated summaries and related interaction metadata.

The information processed and retained depends on the product, customer configuration and applicable legal requirements.

1.9 Payment and Transaction Information

Where the Services support payment-related functionality, we may process order amounts, transaction identifiers, payment status, refunds and reconciliation information.

Payments may be handled through third-party payment service providers selected or authorised by the customer. Where payment credentials or card details are processed directly by a payment provider, those details are subject to that provider's systems and privacy practices.

RigAI does not intentionally store full payment card details or security codes unless a specific service is expressly designed and authorised to do so in accordance with applicable requirements.

2. How We Use Information

We process information for purposes including:

Providing, operating and maintaining the Services.
Configuring customer accounts, properties, venues and authorised users.
Enabling guest communication, digital menus, ordering and service requests.
Connecting to customer-authorised third-party platforms and business systems.
Processing messages, reservations, orders and operational workflows.
Providing AI-assisted responses, information retrieval, summarisation and automation.
Generating operational reports, analytics and management information.
Authenticating users and managing permissions.
Providing technical support, troubleshooting and customer assistance.
Monitoring system performance, preventing misuse and protecting platform security.
Maintaining backups, business continuity and disaster recovery.
Meeting contractual obligations and applicable legal requirements.
Investigating security incidents, fraud, misuse and unauthorised access.
Developing and improving the reliability, performance and functionality of our Services, subject to applicable law, contractual restrictions and customer instructions.

We process personal information only for purposes that are consistent with the relevant customer relationship, authorised functionality, applicable legal grounds and this Policy.

RigAI does not sell personal information.

3. AI Processing and Automated Functionality

Certain Services use artificial intelligence and machine learning technologies for conversational assistance, voice interactions, information retrieval, summarisation, content processing, recommendations and workflow automation.

Depending on the Service, information may be transmitted to third-party AI technology providers, including OpenAI and Google, when necessary to deliver the requested functionality.

Information sent to these providers may include relevant prompts, text, conversation excerpts, transcripts, operational information or other data required for a particular AI task.

We seek to limit the information transmitted to what is reasonably necessary for the relevant functionality and apply appropriate contractual, technical and organisational safeguards.

RigAI does not use identifiable Customer Data or Guest Data to train its own general-purpose AI models unless expressly agreed with the customer in writing or otherwise permitted by applicable law.

The processing and retention practices of third-party AI providers are governed by their applicable agreements, settings and policies.

AI-generated outputs may be inaccurate, incomplete or unsuitable for particular circumstances. Customers remain responsible for reviewing and appropriately using AI-generated information in their operations, particularly for decisions affecting individuals.

4. Voice, Messaging and Conversation Data

Where enabled, our Services may support voice calls, text messaging, WhatsApp communications, other supported messaging channels and related customer interactions.

Depending on the configuration, we may process:

Incoming and outgoing messages.
Sender and recipient identifiers.
Message timestamps and delivery status.
Audio recordings, where recording is enabled.
Speech transcripts and conversation summaries.
Service requests, customer preferences and interaction history.
Operational records associated with responding to or resolving requests.

Recording and retention capabilities may vary by product and configuration.

Customers are responsible for providing required notices and obtaining any necessary consents or permissions before recording or processing conversations, and for complying with applicable telecommunications, privacy and messaging requirements.

Messages sent through third-party platforms remain subject to the applicable platform's terms, policies and technical restrictions.

5. Meta Platform Data and Connected Business Accounts

When RigAI integrates with Facebook, Instagram, WhatsApp or other Meta services, we handle the information received through those integrations in accordance with this Policy, the permissions granted, applicable Meta Platform Terms and Developer Policies, and applicable law.

5.1 Authorised Access

Access to Meta platform information is limited to the permissions and functionality authorised for the relevant integration. Business customers are responsible for ensuring that they have the authority to connect their accounts and permit the requested processing.

We do not use Meta platform data for purposes incompatible with the functionality for which it was obtained or the permissions granted.

5.2 Use and Disclosure

Meta platform information may be used to deliver authorised messaging, customer support, guest communication, account connection, automation and reporting functionality.

We may share relevant information with contracted technology providers only as necessary to operate, secure or support the relevant functionality, subject to applicable contractual, legal and platform requirements.

We do not sell Meta platform data or use it for unrelated advertising purposes.

5.3 Retention and Deletion

We retain Meta platform data only for as long as necessary for authorised functionality, legitimate operational purposes, applicable contractual requirements or legal obligations.

When a customer disconnects a Meta integration, we will cease the corresponding access and processing, subject to any other valid authorisation. Information that is no longer required will be deleted or anonymised in accordance with our retention and deletion procedures and applicable platform requirements.

Individuals and business customers may request deletion of relevant data using the procedure described in Section 12.

6. Customer Data and Ownership

Customers retain their rights in the business information and content they provide to or process through the Services, including Guest Data processed on their behalf, subject to applicable third-party rights and law.

RigAI does not acquire ownership of Customer Data merely by providing the Services.

RigAI retains its rights in its software, source code, platform architecture, products, technology, workflows, automation, AI orchestration, prompts and system logic, documentation, trademarks, branding and other proprietary intellectual property.

We process Customer Data as necessary to provide, secure, maintain and support the Services, follow documented customer instructions, meet contractual obligations and comply with applicable law.

Where RigAI processes personal information on behalf of a business customer, that customer generally determines the purposes and means of processing and remains responsible for its applicable privacy obligations. RigAI provides assistance as required under the relevant agreement and applicable law.

7. Third-Party Integrations and Service Providers

RigAI uses third-party technology and may integrate with external systems to deliver customer-authorised functionality.

Depending on the Services used, these may include:

Social and messaging platforms: Meta, Facebook, Instagram, WhatsApp and other supported communication services.
Hospitality and property management systems: Oracle Hospitality OPERA Cloud and other supported PMS or hospitality platforms.
Cloud infrastructure and databases: Google Cloud, Supabase and other providers used for hosting, storage, databases and infrastructure.
Artificial intelligence: OpenAI, Google and other AI providers used for supported functionality.
Communications and telephony: Twilio and other supported voice, email, SMS or messaging providers.
Payment services: Razorpay, Paytm, PhonePe, Cashfree, PayU or other providers where a payment integration is enabled.
Identity and authentication services: Providers used to authenticate authorised users and secure accounts.
Analytics, monitoring and security: Providers used for diagnostics, operational monitoring, fraud prevention and platform security.

This list describes potential providers and integration categories; it does not mean that every provider is currently connected or processes information for every customer.

We share information with these providers only as reasonably necessary to deliver the relevant Services, follow authorised instructions, operate integrations, maintain security or comply with legal requirements.

Third-party providers may independently process certain information under their own terms and privacy policies. Customers and users should review those policies where relevant.

We do not authorise third-party providers to use Customer Data for unrelated purposes merely because they provide infrastructure or integration services to RigAI.

8. Data Storage, Retention and Deletion

We use cloud infrastructure and technology providers to store and process information. The providers and locations used may vary by product, customer configuration and contractual requirements.

We retain personal information only for as long as reasonably necessary for the purposes described in this Policy, the relevant customer agreement, applicable legal obligations, security requirements and legitimate business purposes.

Unless otherwise agreed with the customer or required by law, Customer Data is generally scheduled for deletion within 90 days following termination of the applicable Services. Specific products, integrations, data categories or customer agreements may have different retention periods.

Customers may request earlier deletion where supported by the relevant Service and subject to applicable legal, contractual and technical requirements.

We may retain limited information where reasonably necessary to comply with legal obligations, resolve disputes, enforce agreements, maintain security or establish, exercise or defend legal claims.

Information in backup and disaster recovery systems may remain temporarily after deletion from active systems and will be removed or overwritten in accordance with applicable backup retention procedures.

Where applicable platform terms require a shorter deletion period, those requirements will be followed.

9. Data Security

RigAI implements technical, organisational and administrative safeguards designed to protect information against unauthorised access, alteration, disclosure, loss or destruction.

Depending on the Service, these measures may include:

Authentication and role-based access controls.
Access restrictions and permissions management.
Secure transmission and storage mechanisms.
Logging, monitoring and audit trails.
Credential and secret management.
Backup and recovery procedures.
Security testing, incident investigation and remediation.
Controlled access to customer information.

We review and improve our security practices as our Services evolve. No method of electronic transmission, processing or storage can guarantee absolute security.

Customers are responsible for protecting their own accounts, devices, credentials and access permissions and for promptly notifying us of suspected unauthorised access affecting the Services.

10. International Data Processing

RigAI serves customers across multiple regions and may use technology providers that operate internationally.

Personal information may therefore be processed or stored in countries other than the country in which it was collected.

Where required by applicable law, we implement appropriate safeguards for international transfers and take reasonable steps to ensure that information receives an appropriate level of protection.

The location and availability of data storage may vary by Service, provider and customer configuration.

11. Privacy Rights and Legal Grounds

Depending on the applicable law and the circumstances of the processing, individuals may have rights to:

Request access to their personal information.
Request correction or updating of inaccurate information.
Request deletion of personal information.
Request restriction of, or object to, certain processing.
Request a copy of information in an applicable portable format.
Withdraw consent where processing is based on consent.
Raise a complaint with the relevant privacy or data protection authority.

These rights are subject to applicable legal conditions, exceptions and retention obligations.

Where RigAI processes information on behalf of a hotel, restaurant or other business customer, that customer may be the appropriate first point of contact for requests concerning the information it controls. RigAI will provide reasonable assistance where required under the relevant agreement or applicable law.

Where RigAI acts as an independent controller, we will assess and respond to requests in accordance with applicable law.

12. Data Deletion Requests

Individuals and business customers may request deletion of personal information processed through RigAI's Services, including relevant information received through Meta platforms, messaging integrations and connected business systems.

To request deletion, email compliance@rigai.io with the subject line Data Deletion Request.

Please identify the relevant RigAI Service, the affected account or business where applicable, and the type of information you wish to have deleted. We may request reasonable information to verify the request and locate the relevant records. Do not send passwords, access tokens or other sensitive authentication credentials.

We will assess valid requests, coordinate with the relevant business customer where necessary, and delete or anonymise information where required and permitted by applicable law and our contractual obligations.

For information received through Facebook, Instagram or WhatsApp integrations, users may also need to disconnect the relevant integration or follow any additional deletion instructions made available by the applicable platform.

Where a customer disconnects an integration, RigAI will stop the corresponding access and processing, subject to any other valid authorisation or legal requirement.

We will respond within the timeframes required by applicable law. Information that must be retained for legal, security or contractual reasons may be retained for the applicable period and handled in accordance with this Policy.

Backup copies may remain temporarily until removed under our backup retention procedures.

13. Cookies and Similar Technologies

Our websites may use cookies and similar technologies for essential functionality, security, analytics, performance measurement and user preferences.

Where required by law, we provide appropriate information and mechanisms to manage cookie preferences.

Our use of cookies may vary by website and Service. Please refer to the relevant Cookie Policy or cookie preference controls where available.

14. Children's Privacy

Our Services are designed primarily for business and enterprise use and are not intended to be directed at children.

RigAI does not knowingly collect personal information directly from children through Services intended for business users. However, hotel and hospitality customers may process information relating to family members or minors as part of their authorised operations.

Customers are responsible for ensuring that any processing of information relating to children complies with applicable law and that required notices, permissions and safeguards are in place.

15. Third-Party Websites and Services

Our websites and Services may contain links to, or integrate with, third-party websites, applications and platforms.

RigAI does not control the privacy practices of independent third-party services. Their handling of information is governed by their own terms and privacy policies.

The inclusion of a third-party integration does not imply that RigAI owns, controls or endorses that provider.

16. Changes to This Privacy Policy

We may update this Policy to reflect changes to our Services, technology, integrations, business practices, legal requirements or privacy obligations.

When we make material changes, we will update the "Last Updated" date at the beginning of this Policy and provide additional notice where appropriate or required by law.

The latest version will be published at the URL where this Policy is made available.

17. Contact Us

For privacy, data protection, access, correction or deletion requests:

RigAI Tech Pvt. Ltd.
Email: compliance@rigai.io

For general support and service enquiries:

Email: support@rigai.io

Country of establishment: India.

Please include sufficient information to help us understand and respond to your enquiry. Do not include passwords, access tokens or unnecessary sensitive personal information in your email.

This Privacy Policy applies to RigAI's websites, products, applications, integrations and Services as described above. Specific Services or customer agreements may contain additional privacy, data processing, retention or security terms.

Home

Legal

Privacy Policy

Updated 1 October 2026 · Version 3.0

How RigAI collects, uses, stores, shares and protects information across our website, products, integrations and cloud services.

RigAI Tech Pvt. Ltd.

RigAI primarily provides software and technology services to businesses, including hotels, resorts, hotel groups, restaurants, travel companies and other enterprises.

Depending on the Services enabled by a customer, we may process information about business customers, employees, authorised users, hotel guests, restaurant customers, suppliers and other individuals on behalf of our customers.

This Policy applies to personal information processed by RigAI in its capacity as a service provider, data processor, or independent data controller, as applicable to the particular activity.

1. Information We Collect and Process

The information we process depends on the Services used, the integrations enabled, the permissions granted and the configuration selected by the relevant customer.

1.1 Business and Account Information

We may process:

Names, job titles, business email addresses and telephone numbers.

Business names, addresses and organisation details.

Account identifiers, authentication information and user roles.

Billing, invoicing and tax information.

Customer onboarding details, service configurations and preferences.

Records of communications with our sales, support and account management teams.

1.2 Authentication and Connected Account Access

RigAI does not ask users to provide their Facebook, Instagram, WhatsApp or other third-party account passwords directly to RigAI.

Integration credentials and access tokens, where used, are treated as confidential information and protected through appropriate access controls and security measures.

1.3 Technical, Device and Usage Information

When users access our websites, applications or Services, we may process:

IP addresses, browser types and device information.

Operating systems, application versions and connection information.

Usage events, diagnostic information and error reports.

Security alerts, audit trails and operational monitoring information.

We use this information to operate our Services, troubleshoot issues, maintain security and improve reliability.

1.4 Hotel, Reservation and Guest Information

Where a customer enables relevant functionality or integrations, we may process:

Guest names, contact details and reservation identifiers.

Room numbers, stay dates, arrival and departure information.

Reservation status, room assignments and service preferences.

Guest requests, feedback, service histories and loyalty-related information.

Restaurant orders, food and beverage preferences and service transactions.

Housekeeping requests, maintenance requests and other hotel operational records.

Guest communications, transcripts, summaries and related service records.

1.5 Meta, Facebook, Instagram and WhatsApp Information

Depending on the integration and permissions enabled, this may include:

Facebook Page identifiers and business account information.

Instagram professional account identifiers, usernames and permitted profile information.

WhatsApp Business Account identifiers, business phone number identifiers and permitted business profile information.

Messages and message content received through supported messaging integrations.

Message timestamps, delivery receipts, read receipts, status notifications and webhook event information.

Relevant conversation identifiers, routing information and customer service records.

Authorisation and connection metadata required to maintain the integration.

Access permissions and integration configuration information.

We process this information to provide authorised messaging, guest communication, customer service, automation, operational workflows, reporting and related features requested by the customer.

The actual information accessible to RigAI depends on the applicable Meta product, the permissions granted, the customer's account configuration and the relevant platform policies.

RigAI does not claim access to information that the applicable APIs and permissions do not make available. We do not request users' Facebook, Instagram or WhatsApp account passwords.

1.6 Property Management Systems and Hotel Integrations

Depending on the integration and permissions granted, information may include:

Reservation, arrival, departure and room information.

Guest profiles and contact information.

Room status, housekeeping and maintenance information.

Guest requests, service messages and operational updates.

Authorised master data, transaction information and relevant reporting data.

Integration identifiers, event notifications, configuration and diagnostic records.

We access and process only the information made available through the relevant integration and authorised for the customer's use of the Services.

1.7 Customer-Provided Content

Customers may provide menus, food and beverage descriptions, images, logos, brochures, brand assets, operating procedures, policies, service catalogues, training materials and other business content.

We process such content to configure, operate and deliver the relevant Services, including digital menus, ordering, guest communication, AI-assisted workflows, operational management and reporting.

1.8 Voice and Conversation Information

The information processed and retained depends on the product, customer configuration and applicable legal requirements.

1.9 Payment and Transaction Information

Where the Services support payment-related functionality, we may process order amounts, transaction identifiers, payment status, refunds and reconciliation information.

Payments may be handled through third-party payment service providers selected or authorised by the customer.

Where payment credentials or card details are processed directly by a payment provider, those details are subject to that provider's systems and privacy practices.

RigAI does not intentionally store full payment card details or security codes unless a specific service is expressly designed and authorised to do so in accordance with applicable requirements.

2. How We Use Information

We process information for purposes including:

Providing, operating and maintaining the Services.

Configuring customer accounts, properties, venues and authorised users.

Enabling guest communication, digital menus, ordering and service requests.

Connecting to customer-authorised third-party platforms and business systems.

Processing messages, reservations, orders and operational workflows.

Providing AI-assisted responses, information retrieval, summarisation and automation.

Generating operational reports, analytics and management information.

Authenticating users and managing permissions.

Providing technical support, troubleshooting and customer assistance.

Monitoring system performance, preventing misuse and protecting platform security.

Maintaining backups, business continuity and disaster recovery.

Meeting contractual obligations and applicable legal requirements.

Investigating security incidents, fraud, misuse and unauthorised access.

Developing and improving the reliability, performance and functionality of our Services, subject to applicable law, contractual restrictions and customer instructions.

We process personal information only for purposes that are consistent with the relevant customer relationship, authorised functionality, applicable legal grounds and this Policy.

RigAI does not sell personal information.

3. AI Processing and Automated Functionality

Depending on the Service, information may be transmitted to third-party AI technology providers, including OpenAI and Google, when necessary to deliver the requested functionality.

Information sent to these providers may include relevant prompts, text, conversation excerpts, transcripts, operational information or other data required for a particular AI task.

We seek to limit the information transmitted to what is reasonably necessary for the relevant functionality and apply appropriate contractual, technical and organisational safeguards.

RigAI does not use identifiable Customer Data or Guest Data to train its own general-purpose AI models unless expressly agreed with the customer in writing or otherwise permitted by applicable law.

The processing and retention practices of third-party AI providers are governed by their applicable agreements, settings and policies.

4. Voice, Messaging and Conversation Data

Where enabled, our Services may support voice calls, text messaging, WhatsApp communications, other supported messaging channels and related customer interactions.

Depending on the configuration, we may process:

Incoming and outgoing messages.

Sender and recipient identifiers.

Message timestamps and delivery status.

Audio recordings, where recording is enabled.

Speech transcripts and conversation summaries.

Service requests, customer preferences and interaction history.

Operational records associated with responding to or resolving requests.

Recording and retention capabilities may vary by product and configuration.

Messages sent through third-party platforms remain subject to the applicable platform's terms, policies and technical restrictions.

5. Meta Platform Data and Connected Business Accounts

5.1 Authorised Access

Access to Meta platform information is limited to the permissions and functionality authorised for the relevant integration.

Business customers are responsible for ensuring that they have the authority to connect their accounts and permit the requested processing.

We do not use Meta platform data for purposes incompatible with the functionality for which it was obtained or the permissions granted.

5.2 Use and Disclosure

Meta platform information may be used to deliver authorised messaging, customer support, guest communication, account connection, automation and reporting functionality.

We do not sell Meta platform data or use it for unrelated advertising purposes.

5.3 Retention and Deletion

We retain Meta platform data only for as long as necessary for authorised functionality, legitimate operational purposes, applicable contractual requirements or legal obligations.

When a customer disconnects a Meta integration, we will cease the corresponding access and processing, subject to any other valid authorisation.

Information that is no longer required will be deleted or anonymised in accordance with our retention and deletion procedures and applicable platform requirements.

Individuals and business customers may request deletion of relevant data using the procedure described in Section 12.

6. Customer Data and Ownership

RigAI does not acquire ownership of Customer Data merely by providing the Services.

We process Customer Data as necessary to provide, secure, maintain and support the Services, follow documented customer instructions, meet contractual obligations and comply with applicable law.

RigAI provides assistance as required under the relevant agreement and applicable law.

7. Third-Party Integrations and Service Providers

RigAI uses third-party technology and may integrate with external systems to deliver customer-authorised functionality.

Depending on the Services used, these may include:

Social and messaging platforms: Meta, Facebook, Instagram, WhatsApp and other supported communication services.

Hospitality and property management systems: Oracle Hospitality OPERA Cloud and other supported PMS or hospitality platforms.

Cloud infrastructure and databases: Google Cloud, Supabase and other providers used for hosting, storage, databases and infrastructure.

Artificial intelligence: OpenAI, Google and other AI providers used for supported functionality.

Communications and telephony: Twilio and other supported voice, email, SMS or messaging providers.

Payment services: Razorpay, Paytm, PhonePe, Cashfree, PayU or other providers where a payment integration is enabled.

Identity and authentication services: Providers used to authenticate authorised users and secure accounts.

Analytics, monitoring and security: Providers used for diagnostics, operational monitoring, fraud prevention and platform security.

This list describes potential providers and integration categories; it does not mean that every provider is currently connected or processes information for every customer.

Third-party providers may independently process certain information under their own terms and privacy policies. Customers and users should review those policies where relevant.

We do not authorise third-party providers to use Customer Data for unrelated purposes merely because they provide infrastructure or integration services to RigAI.

8. Data Storage, Retention and Deletion

We use cloud infrastructure and technology providers to store and process information. The providers and locations used may vary by product, customer configuration and contractual requirements.

Unless otherwise agreed with the customer or required by law, Customer Data is generally scheduled for deletion within 90 days following termination of the applicable Services.

Specific products, integrations, data categories or customer agreements may have different retention periods.

Customers may request earlier deletion where supported by the relevant Service and subject to applicable legal, contractual and technical requirements.

We may retain limited information where reasonably necessary to comply with legal obligations, resolve disputes, enforce agreements, maintain security or establish, exercise or defend legal claims.

Where applicable platform terms require a shorter deletion period, those requirements will be followed.

9. Data Security

RigAI implements technical, organisational and administrative safeguards designed to protect information against unauthorised access, alteration, disclosure, loss or destruction.

Depending on the Service, these measures may include:

Authentication and role-based access controls.

Access restrictions and permissions management.

Secure transmission and storage mechanisms.

Logging, monitoring and audit trails.

Credential and secret management.

Backup and recovery procedures.

Security testing, incident investigation and remediation.

Controlled access to customer information.

We review and improve our security practices as our Services evolve. No method of electronic transmission, processing or storage can guarantee absolute security.

Customers are responsible for protecting their own accounts, devices, credentials and access permissions and for promptly notifying us of suspected unauthorised access affecting the Services.

10. International Data Processing

RigAI serves customers across multiple regions and may use technology providers that operate internationally.

Personal information may therefore be processed or stored in countries other than the country in which it was collected.

Where required by applicable law, we implement appropriate safeguards for international transfers and take reasonable steps to ensure that information receives an appropriate level of protection.

The location and availability of data storage may vary by Service, provider and customer configuration.

11. Privacy Rights and Legal Grounds

Depending on the applicable law and the circumstances of the processing, individuals may have rights to:

Request access to their personal information.

Request correction or updating of inaccurate information.

Request deletion of personal information.

Request restriction of, or object to, certain processing.

Request a copy of information in an applicable portable format.

Withdraw consent where processing is based on consent.

Raise a complaint with the relevant privacy or data protection authority.

These rights are subject to applicable legal conditions, exceptions and retention obligations.

RigAI will provide reasonable assistance where required under the relevant agreement or applicable law.

Where RigAI acts as an independent controller, we will assess and respond to requests in accordance with applicable law.

12. Data Deletion Requests

To request deletion, email compliance@rigai.io with the subject line Data Deletion Request.

Do not send passwords, access tokens or other sensitive authentication credentials.

Where a customer disconnects an integration, RigAI will stop the corresponding access and processing, subject to any other valid authorisation or legal requirement.

Backup copies may remain temporarily until removed under our backup retention procedures.

13. Cookies and Similar Technologies

Our websites may use cookies and similar technologies for essential functionality, security, analytics, performance measurement and user preferences.

Where required by law, we provide appropriate information and mechanisms to manage cookie preferences.

Our use of cookies may vary by website and Service. Please refer to the relevant Cookie Policy or cookie preference controls where available.

14. Children's Privacy

Our Services are designed primarily for business and enterprise use and are not intended to be directed at children.

RigAI does not knowingly collect personal information directly from children through Services intended for business users.

However, hotel and hospitality customers may process information relating to family members or minors as part of their authorised operations.

Customers are responsible for ensuring that any processing of information relating to children complies with applicable law and that required notices, permissions and safeguards are in place.

15. Third-Party Websites and Services

Our websites and Services may contain links to, or integrate with, third-party websites, applications and platforms.

RigAI does not control the privacy practices of independent third-party services. Their handling of information is governed by their own terms and privacy policies.

The inclusion of a third-party integration does not imply that RigAI owns, controls or endorses that provider.

16. Changes to This Privacy Policy

We may update this Policy to reflect changes to our Services, technology, integrations, business practices, legal requirements or privacy obligations.

When we make material changes, we will update the "Last Updated" date at the beginning of this Policy and provide additional notice where appropriate or required by law.

The latest version will be published at the URL where this Policy is made available.

17. Contact Us

For privacy, data protection, access, correction or deletion requests:

RigAI Tech Pvt. Ltd. Email: compliance@rigai.io

For general support and service enquiries:

Email: support@rigai.io

Country of establishment: India.

Please include sufficient information to help us understand and respond to your enquiry. Do not include passwords, access tokens or unnecessary sensitive personal information in your email.

Security Privacy Terms Cookies